Manifold Security

• EDR vendors already own the endpoint sensor footprint. If they extend behavioral monitoring to AI agent processes, the standalone visibility case collapses into a platform feature.
• Agent platform vendors could narrow the gap from the other side. If Anthropic and its peers ship native runtime controls and audit trails for tools such as Claude Code, third-party endpoint visibility becomes less urgent for early buyers.
• Manifold identifies no production customers yet. Rivals in agent security with named enterprise references could lock up the emerging budget line before Manifold shows production proof.
• Manifest's intelligence is built over public skill registries the company does not control. Registry operators could add native vetting and scoring, which would erode the free service's draw as a funnel.

Manifold Security targets the gap between what AI agents do and what security tools can see. Coding agents on developer laptops call tools, run commands, and reach source code, production systems, and CI/CD pipelines through MCP servers and third-party skills, and the company argues that endpoint and AI security tooling built for user activity or model prompts does not track those actions. The buyer is the enterprise security team that must let employees adopt agents without losing visibility.

The pain is plausible but mostly vendor-quantified. The homepage cites industry surveys on agent incidents and unsanctioned AI use, and press coverage of the seed round repeats the visibility-gap framing. No independent research or named buyer yet corroborates the problem at the scale the company claims, which holds the problem story at credible rather than proven. [s1, s3, s4, s5]

The Manifold platform watches agent behavior at runtime rather than filtering prompts. The company describes agentless deployment in minutes, discovery of every agent on endpoints along with the MCP servers, tools, resources, and skills each one invokes, risk and exposure assessment, and detection and response when behavior drifts. The positioning line, protecting what agents do rather than what they say, separates it from the prompt-level guardrails the founders built in their previous venture.

Manifest, launched in April 2026, is a free public intelligence index for the AI agent supply chain. It indexes skills, plugins, extensions, and MCP servers with visible scoring, and the company describes graph analysis that maps what a component does and where it sits in the ecosystem. The service is free to browse and likely functions as demand generation for the paid platform.

External validation is the missing layer. There is no public docs portal, sandbox, or third-party evaluation of the platform, so capability claims rest on the vendor's own pages and the publicly accessible Manifest index. [s1, s7, s8]

Manifold enters a crowded agentic AI security field from the endpoint. A cluster of funded startups sells agent discovery, monitoring, or runtime control from adjacent positions, most of them centered on agent platforms or gateways rather than the machines agents run on. Manifold's differentiation is placement, observing agent actions where they execute, on the laptop or server, rather than in a gateway or an agent platform's control plane.

That placement is also the exposure. The company's own pitch, your EDR is blind to agent behavior, names the incumbents best positioned to absorb the capability, since EDR vendors already run sensors on the same endpoints and their buyers already pay for endpoint telemetry. The durable question is whether agent-specific behavioral context is deep enough to stay a product rather than become a feature. [s1, s4, s5]

Public traction evidence is limited to the funding event. The March 2026 seed round, led by Costanoa Ventures with Cherry Ventures, Rain Capital, Modern Technical Fund, and angel investors including former Uber CSO Joe Sullivan and former Google DeepMind CISO Vijay Bolina, is the company's strongest external endorsement. No production customer or design partner is identified in the reviewed sources. The homepage carries endorsement quotes from named security executives and from the company's own investors, and none is labeled a customer reference or describes a production deployment.

The visible motion is early and demo-gated. The paid platform's sales path is a demo request, no pricing is published, and the careers page lists no open roles, which together read as a small team validating with early accounts rather than scaling a sales organization. Manifest, free and open access, is the visible route to an audience before any purchase. [s3, s4, s1, s9, s8]

The founding team's credential is a verified in-domain exit. Neal Swaelens and Oleksandr Yaremchuk created LLM Guard at Laiyer AI, an open-source LLM firewall the vendor calls the most widely adopted in existence, and Protect AI acquired Laiyer in January 2024. Michael McKenna, the third co-founder and CRO, met the pair through that acquisition.

The public team is small and technical. Beyond the three founders, the about page names a head of growth and a chief architect. The seed announcement positions the founders as having built first-generation AI security and now extending coverage to agents that act rather than talk. [s5, s2, s3, s4]

Trust collateral is unusually far along for a company this young. A public trust center at trust.manifold.security lists a SOC 2 Type 1 attestation, an external network penetration test and a web application and API penetration test, both dated March 2026, dozens of enumerated controls, and a subprocessor list naming its cloud, identity, and AI model providers.

The corporate layer is documented but geographically mixed. The privacy policy names Manifold Security, Inc. and a data protection officer address in Berlin, the seed release carries a San Diego dateline, and press describes the company as California-based. A SOC 2 Type 2 attestation, the usual next step after a Type 1, does not yet appear. [s6, s10, s3, s4]

Add analyzed competitors to compare them side by side with Manifold Security.

Manifold targets enterprises whose employees already run AI agents on their computers, and its stated buyer is the security team that must permit that adoption without losing visibility. The initial user population is developers, whose coding agents reach source code and production systems through MCP servers and third-party tools, and the company argues the same exposure is spreading to every knowledge worker as agent tools move beyond engineering.

The segmentation is a thesis rather than an evidenced beachhead. No production customer, industry vertical, or deployment size appears in the public record, so who actually buys first, and at what company size, cannot be read from outside. The vendor's surveys-heavy framing of the pain also leaves open how much of the urgency is budget-backed today.

The platform's claimed advantage is watching actions instead of words. Manifold observes agent behavior at runtime, discovering every agent on an endpoint, mapping the MCP servers, tools, resources, and skills each one invokes, assessing risk and exposure, and detecting and responding when behavior drifts, a runtime-behavior focus beyond the founders' earlier LLM-security work. The company presents agentless deployment in minutes as a second selling point.

Manifest extends the capability story into the AI supply chain. The free index catalogs skills, plugins, extensions, and MCP servers with visible scoring, and the company describes graph analysis that maps what a component does and where it sits in the ecosystem, a response to agent components spreading through public registries with minimal vetting.

If the platform aggregates agent-behavior telemetry across customers, cross-customer baselines of normal agent activity could become an advantage no single tenant can reproduce, but no public evidence yet shows such an asset accumulating. External validation is thin overall: the reviewed record shows no docs portal, benchmark, or third-party evaluation of the platform.

The visible motion is early, demo-gated selling. The paid platform's sales path is a demo request, there is no self-service tier or published pricing for the platform, and the March 2026 seed release frames the capital as fueling product development, all consistent with a company still validating with early accounts.

Manifest is the company's visible route to an audience. The free, open-access index gives security teams and developers a reason to visit and a habit to form before any purchase, and it doubles as a public demonstration of the company's research. No channel partnership, marketplace listing, or reseller motion appears in the reviewed sources, and the homepage's named endorsements come from security executives and the company's own investors rather than labeled customer references.

Manifold publishes no pricing. The platform is sold through demo requests, which for an enterprise security product at this stage usually means negotiated deals sized per engagement, and the public record does not disclose the pricing unit, whether per endpoint, per agent, or per seat.

The one visible pricing decision is Manifest at zero. Giving the supply chain intelligence away positions it as a funnel rather than a revenue line and prices the adjacent intelligence market defensively, since a rival would now charge for something Manifold gives away.

The public materials describe an agentless, endpoint-oriented deployment backed by cloud subprocessors. The vendor's central operational claim is deployment in minutes, which lowers the cost of a first deployment and shortens evaluation cycles for a security team piloting agent visibility.

The operational chain behind the service is documented at an unusual level of detail for the company's age. The trust center carries an enumerated controls section covering infrastructure and product security and a subprocessor list, which gives an evaluating team a concrete picture of what runs where.

Trust collateral leads the company's maturity curve. A public trust center lists a SOC 2 Type 1 attestation, an external network penetration test and a web application and API penetration test both dated March 2026, an enumerated controls section, and a subprocessor list. The gaps are the ones age explains. As of 2026-07-03 the trust center listed no SOC 2 Type 2 attestation, the period-of-time audit that follows a Type 1, and no ISO certification. The privacy program is unusually international for the stage, naming a data protection officer address in Berlin for European matters.

Manifold monitors an ecosystem it does not control. The platform's subject matter, agents, MCP servers, skills, and extensions, is defined by outside actors, most visibly Anthropic, whose 2025 SKILL.md standard created the portable agent-instruction format whose spread Manifest now scores, and the public registries where those components circulate. That position makes coverage breadth a moving target set by others.

The company's own ecosystem surface is thin so far. No integration marketplace, technology alliance program, or published SIEM and SOAR connector list appears in the reviewed sources, so the platform currently reads as a standalone console rather than a node in the buyer's existing security stack.

The founding team is the company's strongest verifiable asset. Neal Swaelens (CEO) and Oleksandr Yaremchuk (CTO) created LLM Guard at Laiyer AI, the open-source LLM firewall the vendor calls the most widely adopted in existence, and Protect AI acquired Laiyer AI in January 2024. Michael McKenna (CRO) met the pair through that acquisition, giving the team a dedicated commercial founder alongside the two builders.

The public team is small. Beyond the founders, the about page names a head of growth and a chief architect, and the careers page listed no open vacancies on the accessed date, a compact public roster for a seed-stage company.